在指定的时间范围内从日志文件中提取数据

Question

我想根据时间范围使用shell脚本（bash）从日志文件中提取信息。日志文件中的一行如下所示：

172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET / HTTP/1.1" 200 123 "" "Mozilla/5.0 (compatible; Konqueror/2.2.2-2; Linux)"

我想提取数据特定间隔。例如，我只需要查看最近一次记录的数据在过去X分钟或X天之前发生的事件。我是shell脚本的新手，但我尝试使用grep命令。

Answer 1

您可以sed为此使用。例如：$ sed -n '/Feb 23 13:55/,/Feb 23 14:00/p' /var/log/mail.logFeb 23 13:55:01 messagerie postfix/smtpd[20964]: connect from localhost[127.0.0.1]Feb 23 13:55:01 messagerie postfix/smtpd[20964]: lost connection after CONNECT from localhost[127.0.0.1]Feb 23 13:55:01 messagerie postfix/smtpd[20964]: disconnect from localhost[127.0.0.1]Feb 23 13:55:01 messagerie pop3d: Connection, ip=[::ffff:127.0.0.1]...这个怎么运作所述-n开关告诉sed不输出在读取文件（默认行为）的每一行。p正则表达式之后的最后一个告诉它打印与前面的表达式匹配的行。该表达式'/pattern1/,/pattern2/'将打印第一个图案和第二个图案之间的所有内容。在这种情况下，它将打印在字符串Feb 23 13:55和字符串之间找到的每一行Feb 23 14:00。

Answer 2

使用grep和正则表达式，例如，如果您希望间隔4分钟的日志：grep "31/Mar/2002:19:3[1-5]" logfile会在2002年3月31日返回19:31到19:35之间的所有日志行。假设您需要从2011年9月27日开始的最后5天，则可以使用以下方法：grep "2[3-7]/Sep/2011" logfile

Answer 3

好吧，我花了一些时间在您的日期格式上.....但是，终于我解决了。让我们以一个示例文件（名为logFile）为例，我做了一点简短。例如，您要在此文件中获得最近5分钟的登录信息：172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:20:41 +0200] "GET&nbsp;### lines below are what you want (5 mins till the last record)172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:27:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET&nbsp;172.16.0.3 - - [31/Mar/2002:19:30:41 +0200] "GET&nbsp;这是解决方案：# this variable you could customize, important is convert to seconds.&nbsp;# e.g 5days=$((5*24*3600))x=$((5*60))&nbsp; &nbsp;#here we take 5 mins as example# this line get the timestamp in seconds of last line of your logfilelast=$(tail -n1 logFile|awk -F'[][]' '{ gsub(/\//," ",$2); sub(/:/," ",$2); "date +%s -d \""$2"\""|getline d; print d;}' )#this awk will give you lines you needs:awk -F'[][]' -v last=$last -v x=$x '{ gsub(/\//," ",$2); sub(/:/," ",$2); "date +%s -d \""$2"\""|getline d; if (last-d<=x)print $0 }' logFile&nbsp; &nbsp; &nbsp;&nbsp;输出：172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:27:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:30:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:30:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:30:41 +0200&nbsp; "GET&nbsp;172.16.0.3 - -&nbsp; 31 Mar 2002 19:30:41 +0200&nbsp; "GET编辑您可能会注意到在输出中[和]消失了。如果您确实希望它们返回，则可以更改最后一个awk行print $0->print $1 "[" $2 "]" $3